audit_rules_privileged_commands rule is failing in ANSSI NT28 High profile evaluation

[cortesana]

Description of problem:

The audit_rules_privileged_commands rule is failing in tests during ANSSI NT28 High profile evaluation.

SCAP Security Guide Version:

Current upstream master branch as of 2023-09-04

Operating System Version:

RHEL 7

Steps to Reproduce:

1. oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_anssi_nt28_high --progress --report report.html --results results.xml --oval-results contest-ds.xml

Actual Results:

xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands:fail
2023-09-02 11:24:57 test.py:71: lib.results.report_plain:171: FAIL audit_rules_privileged_commands
W: oscap:     Obtrusive data from probe!

Expected Results:

xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands:pass
2023-09-02 11:24:57 test.py:71: lib.results.report_plain:171: PASS audit_rules_privileged_commands

Additional Information/Debugging Steps:

[jan-cerny]

the specific test is: /CoreOS/scap-security-guide/hardening/ansible/anssi_nt28_high

[jan-cerny]

I suspect that this might be closely related to issue #11104 which appeared at the same productization run. I think so because issue #11104 is about mount options such as noexec, nosuid and the OVAL in rule audit_rules_privileged_commands heavily depends on partitions with these options.

[jan-cerny]

Both this issue and #11104 appear in the same test (/CoreOS/scap-security-guide/hardening/ansible/anssi_nt28_high).

[marcusburghardt]

It is not longer present in the last productization review. It was likely fixed by #11117